Linux passwd Command

last modified October 23, 2026

The passwd command changes user passwords. Regular users can change only their own password; the root user can set the password of any account, lock and unlock accounts, and set password aging rules. Password hashes are stored in /etc/shadow, which only root can read.

The syntax is passwd [options] [user]. The examples use passwd from the shadow-utils suite (version 4.13) on Debian 12, run as the regular user jano with sudo rights and two other accounts, alice and bob. Passwords typed at the prompts are not echoed, so they do not appear in the output.

Changing your own password

Without arguments, passwd changes the password of the current user.

passwd

For security, a regular user must first enter the current password. The new password is typed twice to catch typing mistakes.

$ passwd
Changing password for jano.
Current password:
New password:
Retype new password:
passwd: password updated successfully

Password quality checks

The password checks are done by PAM (Pluggable Authentication Modules), so the rules depend on the system configuration.

passwd

The first new password, abc, is rejected as too short, and passwd asks again. Debian's default pam_unix configuration requires at least six characters and rejects passwords that are too simple or too similar to the old one. Stricter rules, such as a minimum length or character classes, are configured with pam_pwquality in /etc/security/pwquality.conf.

$ passwd
Changing password for jano.
Current password:
New password:
Retype new password:
You must choose a longer password.
New password:
Retype new password:
passwd: password updated successfully

Setting another user's password

The root user can set the password of any account, without knowing the old one.

sudo passwd alice

This is how administrators set an initial password for a new account or reset a forgotten one. With Debian's default PAM configuration, the length checks shown in the previous section do not apply to root, so the administrator is responsible for choosing a strong password.

$ sudo passwd alice
New password:
Retype new password:
passwd: password updated successfully

Displaying the password status

The -S (--status) option prints the password status of an account.

sudo passwd -S alice
sudo passwd -S bob
passwd -S

The fields are the user name, the status, the date of the last change, the minimum and maximum password age in days, the warning period, and the inactivity period (-1 means none). The status is P for a usable password, L for a locked password, and NP for no password. The account bob was created with useradd and never got a password, so it is locked. A regular user can query their own status.

$ sudo passwd -S alice
alice P 2026-10-23 0 99999 7 -1
$ sudo passwd -S bob
bob L 2026-10-23 0 99999 7 -1
$ passwd -S
jano P 2026-10-23 0 99999 7 -1

The shadow file

The information comes from /etc/shadow.

sudo grep -E '^(alice|bob):' /etc/shadow

The fields are separated by colons: name, password hash, last change, minimum age, maximum age, warning period, inactivity period, and account expiration date. Dates are stored as days since January 1, 1970; 20749 is October 23, 2026. The hash starts with $y$, the identifier of yescrypt, the default hashing method on current Debian and Ubuntu. A ! instead of a hash means that no password login is possible.

$ sudo grep -E '^(alice|bob):' /etc/shadow
alice:$y$j9T$Di9aGRd05zhOv5ZEbbjL9/$giRx0JWr6FH2SMdmWAgfETZqJksKCBot2gBEYvuLbhA:20749:0:99999:7:::
bob:!:20749:0:99999:7:::

Locking and unlocking a password

The -l option locks the password and -u unlocks it.

sudo passwd -l alice
sudo passwd -S alice
sudo grep '^alice:' /etc/shadow | cut -c1-20
sudo passwd -u alice
sudo passwd -S alice

Locking puts a ! in front of the hash, so no password can match it, and unlocking removes it again; the old password is kept. A locked password does not disable the account: the user can still log in with SSH keys. To block an account completely, also expire it with sudo usermod --expiredate 1 alice or sudo chage -E 0 alice.

$ sudo passwd -l alice
passwd: password changed.
$ sudo passwd -S alice
alice L 2026-10-23 0 99999 7 -1
$ sudo grep '^alice:' /etc/shadow | cut -c1-20
alice:!$y$j9T$Di9aGR
$ sudo passwd -u alice
passwd: password changed.
$ sudo passwd -S alice
alice P 2026-10-23 0 99999 7 -1

Forcing a password change

The -e (--expire) option expires the password, so the user must change it at the next login.

sudo passwd -e alice
sudo passwd -S alice
sudo chage -l alice

The date of the last change is set to 0, which passwd -S shows as 1970-01-01. The chage -l command prints the aging information in a readable form. Expiring the password is useful after setting an initial password for a new user.

$ sudo passwd -e alice
passwd: password changed.
$ sudo passwd -S alice
alice P 1970-01-01 0 99999 7 -1
$ sudo chage -l alice
Last password change					: password must be changed
Password expires					: password must be changed
Password inactive					: password must be changed
Account expires						: never
Minimum number of days between password change		: 0
Maximum number of days between password change		: 99999
Number of days of warning before password expires	: 7

Password aging

The -n, -x, and -w options set the minimum age, the maximum age, and the warning period in days.

sudo passwd -n 1 -x 90 -w 14 alice
sudo passwd -S alice
sudo chage -l alice

After this change, alice can change the password at most once a day, must change it every 90 days, and is warned 14 days in advance. chage -l computes the expiration date. Current guidelines, such as NIST SP 800-63B, advise against forced periodic changes unless a password is known to be compromised, so use maximum ages only where a policy requires them.

$ sudo passwd -n 1 -x 90 -w 14 alice
passwd: password changed.
$ sudo passwd -S alice
alice P 2026-10-23 1 90 14 -1
$ sudo chage -l alice
Last password change					: Oct 23, 2026
Password expires					: Jan 21, 2027
Password inactive					: never
Account expires						: never
Minimum number of days between password change		: 1
Maximum number of days between password change		: 90
Number of days of warning before password expires	: 14

Deleting a password

The -d (--delete) option removes the password, leaving the hash field empty.

sudo passwd -d bob
sudo passwd -S bob
sudo grep '^bob:' /etc/shadow

The status is now NP. Whether an empty password allows a login depends on PAM: Debian's configuration uses the nullok option, which accepts it for local logins, while SSH rejects empty passwords by default. Use -l instead of -d to disable password logins.

$ sudo passwd -d bob
passwd: password changed.
$ sudo passwd -S bob
bob NP 2026-10-23 0 99999 7 -1
$ sudo grep '^bob:' /etc/shadow
bob::20749:0:99999:7:::

Setting passwords in scripts

passwd reads the password from the terminal. For scripts, the chpasswd command reads user:password pairs from standard input.

echo 'bob:Red-Bicycle-31' | sudo chpasswd
sudo passwd -S bob

chpasswd hashes the password with the system's default method. It can set many passwords at once, one pair per line. Keep such input out of shell history and command lines; read it from a protected file instead. The --stdin option known from Red Hat systems is not available in the Debian version of passwd.

$ echo 'bob:Red-Bicycle-31' | sudo chpasswd
$ sudo passwd -S bob
bob P 2026-10-23 0 99999 7 -1

Status of all accounts

The -a (--all) option, combined with -S, prints the status of every account.

sudo passwd -Sa | head -n 3
sudo passwd -Sa | grep -v " L "

System accounts such as daemon and bin are locked because nobody logs in as them. Filtering out locked accounts shows the accounts that can log in with a password, which is a quick audit.

$ sudo passwd -Sa | head -n 3
root L 2025-09-29 0 99999 7 -1
daemon L 2025-09-29 0 99999 7 -1
bin L 2025-09-29 0 99999 7 -1
$ sudo passwd -Sa | grep -v " L "
jano P 2026-10-23 0 99999 7 -1
alice P 2026-10-23 1 90 14 -1
bob P 2026-10-23 0 99999 7 -1

Permission errors

Regular users cannot change or lock other accounts.

passwd alice
passwd -l alice

passwd is a setuid-root program, so it can update /etc/shadow on behalf of a regular user, but it allows that only for the user's own password.

$ passwd alice
passwd: You may not view or modify password information for alice.
$ passwd -l alice
passwd: Permission denied.

Best practices for passwd

• Use long passphrases: Several random words are easier to remember and harder to guess than short complex passwords.
• Expire initial passwords: Set a temporary password and run passwd -e so the user chooses their own.
• Lock instead of delete: Use -l to disable password logins, and expire the account to block SSH keys too.
• Use chpasswd in scripts: Never pipe passwords into passwd or put them on command lines.
• Audit regularly: Check passwd -Sa for accounts with NP status.

Source

passwd(1) manual page

In this article, we have used the passwd command to change passwords, check their status, lock and unlock accounts, force password changes, and set password aging.

Author

My name is Jan Bodnar, and I am a passionate programmer with extensive programming experience. I have been writing programming articles since 2007. To date, I have authored over 1,400 articles and 8 e-books. I possess more than ten years of experience in teaching programming.

List all Linux tutorials.